agentsclimarketplace

Nvidia gpu operator kubernetes hardening

Skill Raishin/vanguard-frontier-agentic/skills/nvidia/nvidia-gpu-operator-kubernetes-hardening

Curated marketplace of AI skills, agents, and rules for cloud, zero-trust, and compliance-aware engineering - works with Claude Code, Codex, Cursor, Copilot, and more.

Install
npx -y skills add Raishin/vanguard-frontier-agentic --skill nvidia-gpu-operator-kubernetes-hardening

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 18 stars18 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use this skill when reviewing NVIDIA GPU Operator deployments on Kubernetes — device plugin, MIG manager, NFD labels, time-sliced GPU configuration, container toolkit, securityContext posture, namespace tenancy, and admission policy coverage. Trigger when the user asks whether GPUs are being shared safely across tenants, whether MIG profiles are enforced, or whether the GPU Operator is deployed per NVIDIA hardening guidance.

SKILL.md

2.7 KB, 413 tokens by cl100k_base, as published. Nobody here has run it

NVIDIA GPU Operator on Kubernetes Hardening

Purpose

Review NVIDIA GPU Operator deployments on Kubernetes against NVIDIA documentation and Kubernetes pod-security hardening: device plugin posture, MIG manager configuration, time-sliced GPU configuration, NFD label usage, container toolkit isolation, securityContext posture for GPU workloads, and admission policy enforcement of GPU resource requests.

Lean operating rules

  • Prefer live evidence (kubectl -n gpu-operator get pods, kubectl get clusterpolicy, kubectl get nodes -L nvidia.com/gpu.product, MIG profile annotations) when the active client exposes it; otherwise fall back to NVIDIA GPU Operator documentation and sanitized manifests.
  • Separate confirmed facts from inference. If MIG strategy, time-slicing config, or admission posture was not directly queried, say so.
  • Treat GPU workload pods running with privileged: true outside of the GPU Operator's own DaemonSets as a critical finding — privilege creep across tenant workloads.
  • Treat MIG-capable nodes running in single strategy on multi-tenant clusters when mixed is required as a high finding — partition diversity is impossible.
  • Treat time-sliced GPU configuration shared across tenants without namespace-scoped admission as a high finding — noisy-neighbor and side-channel risk.
  • Treat absence of an admission policy (Kyverno / OPA / ValidatingAdmissionPolicy) gating nvidia.com/gpu requests by namespace as a high finding for multi-tenant clusters.
  • Treat default GPU Operator deployment with public, unsigned image pulls as a medium finding — add image-verification policy.
  • Treat node-feature-discovery labels absent on GPU nodes as a low finding — scheduling reliability is reduced.

Response minimum

Return, at minimum:

  • the scoped target (cluster, GPU Operator version, MIG strategy) and evidence level,
  • device plugin and toolkit posture,
  • MIG / time-slicing posture,
  • admission policy posture for GPU resources,
  • namespace tenancy posture,
  • image verification posture,
  • safe next actions and assumptions or blockers.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.